For SaaS teams asked to "just let us connect Tableau"
Query GateAn API bug returns a wrong answer. An isolation bug on a live SQL handle returns another customer's rows.
List the views you would expose, the compute handles behind them and any planned schema changes, and answer a short interview. Your browser ranks the architecture by scan economics, audits every view for engine-level isolation, every handle for timeouts and spend caps, and checks the schema contract, credentials and price. Then the blueprint, and the customer contract.
The product, and a short interview free
The surface free
The checks free
A review aid, not a security guarantee: a pass means the plan as you described it passes these checks. Run the probe against the real views and have the design reviewed before any customer gets a handle.
What the page flags
The gates
Architecture and price, ranked
Tenant isolation, view by view
Cost caps, handle by handle
Area by area
Your isolation probe free
Run it as a second test tenant before any customer gets a handle, and after every policy or schema change - every count must be zero.
Probe (SQL)
The access blueprint metered
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
Caveats
Caveats
The page's check of this reply
Saved surfaces
How it works - and what is sourced
The architecture follows the skill. A zero-copy warehouse share is the default while scans are infrequent; a replicated copy or read endpoint once scan frequency inverts the arithmetic (about 20 scans a day on a 200 GB table); per-tenant engines when customers run arbitrary SQL at dashboard or agent frequency across many tenants. An OLTP-only stack has no share rung; a ship date promotes what the platform gives you today. Price it as a tier or add-on - consumption when your own cost is consumption-based - never as a free feature.
Isolation lives in the engine: secure or dynamic views on the share-aware identity, or row-level security with FORCE and the tenant set from a verified token - never an application WHERE filter, never partition filtering, and always probed as another tenant. Serve a curated mart under an additive-only contract enforced in CI. Every compute handle needs a statement timeout, a concurrency cap and a spend cap before the first customer connects; credentials are short-lived tokens, never a password in a connection string.